toolroll 0.9.98 → 0.9.100

package/dist/release-adapters.js

@@ -18,7 +18,8 @@ import { callLabel, readOnlyCall, retryCall, retryingExec, writeWithRecheck } fr
 const sqlite = () => createRequire(import.meta.url)("node:sqlite");
 import { PROTECTION_MINIMUM_CHECKS, PROTECTION_REPORT_ONLY_CHECKS } from "./release.js";
 import { activeUpdateWork } from "./desktop-update-gate.js";
-import { BEFORE_SWAP, gateOwner } from "./release-gate.js";
+import { BEFORE_SWAP, deployActionOf, stoppedWhereNothingChanged } from "./deploy-phase.js";
+import { gateOwner } from "./release-gate.js";
 import { findCliLinks, switchCliLinks } from "./release-links.js";
 import { databasePath, finishReleaseOperation, requireFreshReleaseApproval, openStore, releaseAuthorityOfTask, releaseCarries, releaseOperations, renewReleaseLease, reserveRelease, runReleaseOperation, Store, recordReleaseStep, releaseIssuerGone, takeReleaseLease, } from "./store.js";
 import { acquireDeploymentLock } from "./deploy-lock.js";
@@ -62,8 +63,6 @@ const ownCli = () => {
     const bin = join(dirname(fileURLToPath(import.meta.url)), "bin.js");
     return existsSync(bin) ? [process.execPath, bin] : ["toolroll"];
 };
-/** Journal phases the deployment's finish accepts (scripts/deploy-phases.mjs finish): the new service runs, unproven. */
-const FINISHES_FORWARD = Object.freeze(["started", "healthy"]);
 const cleanEnv = (extra = {}) => {
     const env = { ...process.env, ...extra };
     delete env["NODE_OPTIONS"];
@@ -580,23 +579,40 @@ export function releaseAdapters(options) {
                 const running = (options.processes ?? processes)().filter(one => one.command.includes("deploy-browser.mjs") && one.command.includes(stage));
                 if (running.length > 0)
                     return { ok: false, message: `the deployment is still running (process ${running.map(one => one.pid).join(", ")}); let it finish, then rerun` };
-                // The new service started (deploy-rescue.ts FORWARD_ONLY): recovery refuses to roll it back, so the release
-                // resumes it forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
+                // The new service was started (the phase table's "forward" rows, deploy-phase.ts): the release resumes it
+                // forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
                 // Finishing deploys, so the candidate is proven first, as for a deploy.
-                const phase = (() => { try {
+                const journalPhase = () => { try {
                     return object(JSON.parse(readFileSync(join(stage, "deployment.json"), "utf8")))["phase"];
                 }
                 catch {
                     return undefined;
-                } })();
-                if (FINISHES_FORWARD.includes(String(phase))) {
+                } };
+                const phase = journalPhase();
+                if (deployActionOf(phase) === "forward") {
                     const proven = proveCandidate(runId);
-                    if (!proven.ok)
-                        return stopped(stage, proven.message);
-                    const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
-                    if (finished.code === 0)
+                    let why;
+                    if (proven.ok) {
+                        const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
+                        if (finished.code === 0)
+                            return { ok: true };
+                        why = `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`;
+                    }
+                    else
+                        why = proven.message;
+                    // Once the new service was recorded as started, a journal alone never rolls it back: the release stops here.
+                    // Still at "starting" (killed while waiting for the new service; finish only looks, and it did not find it
+                    // running): the deployment's own recovery puts the previous service back, and only when it proves the new
+                    // one gone. That needs no approval of the candidate, exactly as below.
+                    if (journalPhase() !== "starting")
+                        return stopped(stage, why);
+                    const recorded = recordedCommit(runId);
+                    if (recorded === null)
+                        return stopped(stage, why);
+                    const back = await deployScript(worktree, stage, runId, recorded, ["--phase", "recover"]);
+                    if (back.code === 0)
                         return { ok: true };
-                    return stopped(stage, `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`);
+                    return stopped(stage, `${why} The previous service was not put back either: ${tail(back)}`);
                 }
                 // Recovery needs no approval, but it runs only the recorded commit's own script, extracted by this runtime.
                 const recorded = recordedCommit(runId);
@@ -642,7 +658,7 @@ export function releaseAdapters(options) {
                 catch {
                     return false;
                 }
-                return phase === "preparing" || phase === "released" || phase === "deployed";
+                return stoppedWhereNothingChanged(phase);
             },
             async cliLinks() { return findCliLinks(); },
             async switchLinks(links, bin, version) {

package/dist/release-authority.d.ts

@@ -7,6 +7,15 @@ import { type ReleasePolicy, type ReleaseTerms } from "./contracts/release-terms
 import type { Store } from "./store.js";
 export type ReleaseState = "open" | "deploying" | "merge-reserved" | "merged" | "revoked" | "expired" | "superseded";
 export declare const LIVE_RELEASE_STATES: readonly ReleaseState[];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export declare function releaseExpiredAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): boolean;
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export declare function releaseStateAt(a: Pick<ReleaseAuthority, "state" | "expiresAt">, now: Date): ReleaseState;
 /** One generation of a release a person approved: the single source of truth for it. */
 export type ReleaseAuthority = {
     id: number;

package/dist/release-authority.js

@@ -5,6 +5,19 @@
  */
 import { readReleasePolicy } from "./contracts/release-terms.js";
 export const LIVE_RELEASE_STATES = ["open", "deploying", "merge-reserved"];
+/**
+ * Whether an authority's approval has run out at `now`. Nothing writes the `expired` state: expiry is worked out from
+ * `expires_at` here, and every reader that asks whether an authority is still good asks through this (or
+ * releaseStateAt). The one SQL reader, approval-authority.ts releaseStandsSql, states the same rule in SQL.
+ */
+export function releaseExpiredAt(a, now) {
+    return a.state === "expired" || a.expiresAt <= now.toISOString();
+}
+/** An authority's state as read at `now`: a live one (open, deploying, merge-reserved) past its time reads as `expired`;
+ * an ended one keeps the state it ended in. */
+export function releaseStateAt(a, now) {
+    return LIVE_RELEASE_STATES.includes(a.state) && releaseExpiredAt(a, now) ? "expired" : a.state;
+}
 function readReleaseAuthority(row) {
     const text = (key) => row[key] == null ? null : String(row[key]);
     let policy = null;

package/dist/release-auto.js

@@ -26,7 +26,7 @@ import { releaseCheckStanding } from "./check-failure.js";
 import { CARRY_RULES, rulePath } from "./release-carry.js";
 import { AUTO_EVIDENCE_ACTION, AUTO_WITHDRAWN_ACTION, LIVE_RELEASE_STATES, RELEASE_APPROVAL_ACTION, releaseAuthorityOfTask, releaseAutoApproves, releaseApprovalSetting } from "./release-authority.js";
 import { autoReleaseApprovalOf, personApprovalOf } from "./scope.js";
-import { releaseOperations, revokeRelease } from "./store.js";
+import { releaseOperations, revokeRelease, withdrawApproval } from "./store.js";
 import { RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION, RELEASE_CI_RUNNING_WORDS, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { nightlyDebtHold } from "./nightly-github.js";
@@ -87,8 +87,7 @@ export function setReleaseApproval(store, repo, auto, by, now) {
  * marked withdrawn, so no later reading — the setting turned on again included — lets it stand. */
 function unseal(store, taskId, now) {
     withdraw(store, taskId, now);
-    store.handle.prepare(`UPDATE task_scope SET approved_at = NULL, approved_by = NULL, approved_digest = NULL, approved_profile_json = NULL,
-      approved_route_json = NULL, approval_basis = NULL, mode_digest = NULL WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')`).run(taskId);
+    withdrawApproval(store, { where: "WHERE task_id = ? AND approval_basis IN ('auto-check', 'auto-green')", args: [taskId] }, { basisAfter: null, clearRoute: true, clearModeDigest: true });
 }
 /** Mark a task's automatic seal's evidence withdrawn for good (its seal row may stay while an issued merge reconciles). */
 function withdraw(store, taskId, now) {

package/dist/release-gate.d.ts

@@ -18,9 +18,10 @@
  * Anything missing, damaged or contradicting refuses and leaves the pause as it is. Without --yes it only shows the
  * proof; with --yes it lifts that one pause (the owner is checked again inside the same write) and journals it.
  */
+import { BEFORE_SWAP } from "./deploy-phase.js";
 import type { Database } from "./store.js";
-/** The journal phases a deployment passes before it stops the old service (deploy-phases.mjs). */
-export declare const BEFORE_SWAP: readonly string[];
+/** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
+export { BEFORE_SWAP };
 export type GateReleaseWorld = {
     /** The live database file. */
     database: string;
@@ -81,4 +82,3 @@ export type GateReleaseOutcome = {
 };
 /** Prove, then (with `yes`) lift exactly that pause and journal the release in the deployment's own journal. */
 export declare function releaseGate(id: string, world: GateReleaseWorld, yes: boolean): GateReleaseOutcome;
-export {};

package/dist/release-gate.js

@@ -23,10 +23,11 @@ import { join } from "node:path";
 import { durableJson } from "./desktop-update.js";
 import { removeUpdateGate, updateGateOwned } from "./desktop-update-gate.js";
 import { acquireDeploymentLock } from "./deploy-lock.js";
-/** The journal phases a deployment passes before it stops the old service (deploy-phases.mjs). */
-export const BEFORE_SWAP = Object.freeze(["preparing", "admission-paused", "frozen", "backup-verified", "rehearsed"]);
+import { BEFORE_SWAP, RELEASED } from "./deploy-phase.js";
+/** The journal phases a deployment passes before it stops the old service (deploy-phase.ts, the one table). */
+export { BEFORE_SWAP };
 /** Journal fields that only the swap and later phases write. */
-const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt"];
+const SWAP_FIELDS = ["stoppingService", "codingBackupBeforeSwap", "migration", "newService", "deployedAt", "launchd", "newServiceStop"];
 const GATE_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 const refuse = (reason, message) => ({ ok: false, reason, message: `${message} The update pause was left as it is.` });
 /** The owner id written into the live pause's triggers, when there is one pause and it names one id. */
@@ -121,7 +122,9 @@ export function proveBeforeSwap(id, world) {
     if (staged.length > 0)
         return refuse("after-swap", `Process ${staged.map(one => one.pid).join(", ")} runs from the staged runtime ${r.nextRuntime}.`);
     const supervisor = processes.find(one => one.command.includes(`${r.priorRuntime}/controller-service.js`));
-    const worker = processes.find(one => one.command.includes(`${r.priorRuntime}/cli.js up --db ${world.database}`));
+    // The database as a whole argument: an `up` on a path that only begins with this database's is another service's.
+    const upHere = `${r.priorRuntime}/cli.js up --db ${world.database}`;
+    const worker = processes.find(one => one.command.split(upHere).slice(1).some(rest => rest === "" || /^\s/.test(rest)));
     if (supervisor === undefined || worker === undefined)
         return refuse("conflict", `The service is not running from ${r.priorRuntime}, so it can't be shown that the swap never began.`);
     proof.push(`The service runs from ${r.priorRuntime} (process ${supervisor.pid}); nothing runs from the staged runtime, and no deployment is running.`);
@@ -163,7 +166,7 @@ export function releaseGate(id, world, yes) {
             // The owner is checked again within removeUpdateGate's short write transaction.
             removeUpdateGate(db, id);
             durableJson(journalFile, {
-                ...fresh.journal, phase: "released", updatedAt: world.now().toISOString(),
+                ...fresh.journal, phase: RELEASED, updatedAt: world.now().toISOString(),
                 releasedBeforeSwap: { at: world.now().toISOString(), by: "toolroll release --release-gate", from: fresh.journal.phase, proof: fresh.proof },
             });
             return { ok: true, released: true, id, stage: fresh.stage, proof: fresh.proof };

package/dist/release-next.d.ts

@@ -1,3 +1,4 @@
+import { deployActionOf, type DeployAction } from "./deploy-phase.js";
 import { type RescueWorld } from "./deploy-rescue.js";
 import { type GateReleaseWorld } from "./release-gate.js";
 import { type ReleaseJournal } from "./release.js";
@@ -29,9 +30,8 @@ export type SettleWorld = {
     rescue: RescueWorld;
     gate: GateReleaseWorld;
 };
-export type DeployAction = "none" | "lift-pause" | "forward" | "roll-back" | "refuse";
-/** The one action a deployment's journal calls for. */
-export declare function deployActionOf(phase: unknown): DeployAction;
+/** The one action a deployment's journal calls for: a row of the one phase table (deploy-phase.ts). */
+export { deployActionOf, type DeployAction };
 /** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
 export declare function settleDeployment(world: SettleWorld, say: (line: string) => void): Promise<{
     ok: true;

package/dist/release-next.js

@@ -11,8 +11,9 @@
 import { closeSync, mkdirSync, openSync, readdirSync, readFileSync, rmSync, writeSync } from "node:fs";
 import { hostname } from "node:os";
 import { dirname, join } from "node:path";
-import { FORWARD_ONLY, rescueDeployment } from "./deploy-rescue.js";
-import { BEFORE_SWAP, releaseGate } from "./release-gate.js";
+import { deployActionOf } from "./deploy-phase.js";
+import { rescueDeployment } from "./deploy-rescue.js";
+import { releaseGate } from "./release-gate.js";
 import { journalFile, readJournal } from "./release.js";
 import { autoPublishHeld, PUBLISH_ALLOWED_ACTION } from "./release-auto.js";
 import { sameMachineHost } from "./machine-identity.js";
@@ -78,18 +79,8 @@ export async function takeReleaseRun(stateDir, branch, say, seams = {}) {
         await sleep(seams.pollMs ?? 5_000);
     }
 }
-/** The one action a deployment's journal calls for. */
-export function deployActionOf(phase) {
-    if (typeof phase !== "string")
-        return "refuse";
-    if (phase === "released" || phase === "deployed")
-        return "none";
-    if (BEFORE_SWAP.includes(phase))
-        return "lift-pause";
-    if (FORWARD_ONLY.includes(phase))
-        return "forward";
-    return "roll-back";
-}
+/** The one action a deployment's journal calls for: a row of the one phase table (deploy-phase.ts). */
+export { deployActionOf };
 /** Settle what a stopped deployment left, saying what was done. A refusal stops the release before it does anything. */
 export async function settleDeployment(world, say) {
     const open = world.rescue.journals().filter(one => deployActionOf(one.journal?.["phase"]) !== "none");
@@ -99,8 +90,14 @@ export async function settleDeployment(world, say) {
         return { ok: false, message: `${open.length} deployments are unfinished: ${open.map(one => one.stage).join(", ")}. Nothing was changed.` };
     const { stage, journal } = open[0];
     const action = deployActionOf(journal?.["phase"]);
-    if (action === "refuse")
-        return { ok: false, message: `The deployment journal in ${stage} can't be read. Nothing was changed.` };
+    if (action === "refuse") {
+        // A word this version's table does not hold (a newer candidate's, or damage) is never acted on by itself: the
+        // deployment's own recovery knows its own phases, and the person starts it.
+        const phase = journal?.["phase"];
+        return typeof phase === "string"
+            ? { ok: false, message: `The deployment in ${stage} stopped at a step this version doesn't know (${/^[a-z-]{1,40}$/.test(phase) ? phase : "not a plain word"}). Nothing was changed. Its own recovery can decide: \`toolroll release --recover-deploy --yes\`.` }
+            : { ok: false, message: `The deployment journal in ${stage} can't be read. Nothing was changed.` };
+    }
     if (action === "forward") {
         say("Finishing the deployment that was under way.");
         return { ok: true };

package/dist/release-view.js

@@ -6,6 +6,7 @@
 import { liveReleaseOf } from "./scope.js";
 import { nightlyReleaseLines } from "./nightly-github.js";
 import { releaseAuthorityOfTask, releaseCarries } from "./store.js";
+import { releaseStateAt } from "./release-authority.js";
 export function releaseViewOf(store, taskId, now, obligations = () => []) {
     const found = releaseAuthorityOfTask(store, taskId);
     if (found === null)
@@ -18,7 +19,7 @@ export function releaseViewOf(store, taskId, now, obligations = () => []) {
     return {
         kind: found.carry === null ? "anchor" : "carried",
         authority: a.id, version: a.version, pr: a.pr, state: a.state,
-        carrying: a.state === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
+        carrying: releaseStateAt(a, now) === "open" && live.applies && live.ok, why: live.applies && !live.ok ? live.why : null,
         approver: anchor?.approvedBy ?? null, anchorTask: a.anchorTask, tipTask: a.tipTask, expiresAt: a.expiresAt,
         landed: releaseCarries(store, a.id).flatMap(carry => carry.commits.map(commit => ({ sha: commit.sha, task: carry.taskId, files: commit.files }))),
         obligations: obligations(a.id),

package/dist/release.js

@@ -667,6 +667,17 @@ export async function runRelease(options, adapters) {
                 return head !== null && head !== j.candidate.sha ? head : null;
             });
         };
+        /**
+         * Move the release back to an earlier step: write the fields the caller names (and only those), drop the named steps'
+         * intents, set the step, and save the journal. Every step-back goes through here.
+         */
+        const rewindTo = (step, fields, dropIntents = []) => {
+            Object.assign(j, fields);
+            for (const one of dropIntents)
+                delete j.intents[one];
+            j.step = step;
+            save();
+        };
         const restart = async (head, updated = false) => {
             // The step this commit was at ends here: the release goes on with the new commit (and, filed again, a new task).
             mark(j.step, "failed", `${j.branch} moved to ${head.slice(0, 7)}`);
@@ -678,16 +689,10 @@ export async function runRelease(options, adapters) {
                 const carried = await rel.carry(j.authority.id, head, randomUUID(), epoch);
                 if (carried.ok) {
                     const view = await rel.authority(carried.taskId);
+                    // The candidate is written before the gate is read, as it always was: a gate that fails leaves it moved.
                     j.candidate = { sha: head, tree };
-                    j.task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
-                    j.check = null;
-                    j.completion = null;
-                    j.landed = view?.landed ?? j.landed ?? [];
-                    delete j.intents.check;
-                    delete j.intents.complete;
-                    j.step = "check";
-                    j.stopped = null;
-                    save();
+                    const task = { id: carried.taskId, scopeDigest: (await adapters.toolroll.gate(carried.taskId)).scopeDigest };
+                    rewindTo("check", { task, check: null, completion: null, landed: view?.landed ?? j.landed ?? [], stopped: null }, ["check", "complete"]);
                     say(`  carried the approval to ${head.slice(0, 7)} (task ${carried.taskId})`);
                     return;
                 }
@@ -695,30 +700,16 @@ export async function runRelease(options, adapters) {
             }
             else
                 say(`  ${j.branch} moved to ${head.slice(0, 7)}: filing it for approval`);
-            j.candidate = { sha: head, tree };
-            j.task = { id: gateTaskId(j.packageVersion, head), scopeDigest: null };
-            j.approval = null;
-            j.check = null;
-            j.completion = null;
-            j.authority = null;
-            j.auto = null;
             epoch = null;
-            delete j.intents.gate;
-            delete j.intents.check;
-            delete j.intents.complete;
-            j.step = "gate";
-            j.stopped = null;
-            save();
+            rewindTo("gate", { candidate: { sha: head, tree }, task: { id: gateTaskId(j.packageVersion, head), scopeDigest: null },
+                approval: null, check: null, completion: null, authority: null, auto: null, stopped: null }, ["gate", "check", "complete"]);
         };
         /**
          * The automatic road ended without an approval: the plane takes its `auto-check` back (the task asks a person, its
          * passing check kept) and tells the owner; the release waits at approval for a person, as without the setting.
          */
         const autoRefused = async (why) => {
-            j.auto = { state: "refused", why };
-            j.check = null;
-            j.step = "approval";
-            save();
+            rewindTo("approval", { auto: { state: "refused", why }, check: null });
             await rel?.auto?.giveUp(j.task.id, why);
             throw new Stop("approval", `Not approved automatically: ${why}. A person approves task ${j.task.id} (\`toolroll task approve ${j.task.id} --digest ${j.task.scopeDigest}\`, or the console), then rerun \`${resume}\`.`);
         };
@@ -1053,10 +1044,7 @@ export async function runRelease(options, adapters) {
                                 }
                                 catch (error) {
                                     if (error instanceof Stop && error.reason === "ci-failed") {
-                                        j.auto = { state: "refused", why: error.message };
-                                        j.check = null;
-                                        j.step = "approval";
-                                        save();
+                                        rewindTo("approval", { auto: { state: "refused", why: error.message }, check: null });
                                         await rel?.auto?.giveUp(j.task.id, error.message.replace(/\.$/, ""));
                                     }
                                     throw error;

package/dist/result-shots.js

@@ -169,6 +169,6 @@ export function refuseResultShots(state, store, part, content, app, now) {
     const title = chatTitle(store, content.image?.taskId ?? content.task ?? "");
     const line = { text: `Screenshots for ${title} weren't sent: the ${app} app isn't allowed to upload files here.`,
         ...(content.task === undefined ? {} : { task: content.task }), ...(content.run === undefined ? {} : { run: content.run }) };
-    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=?").run(savedChatPart(line), now.toISOString(), part.id);
+    state.prepare("UPDATE chat_part SET payload=?,state='pending',next_at=NULL,problem=NULL,file=NULL,uploaded=0,uncertain=0,created=? WHERE provider=:provider AND id=? AND state<>'dropped'").run(savedChatPart(line), now.toISOString(), part.id);
     state.prepare("UPDATE chat_part SET state='dropped',problem='Uploads are not allowed here' WHERE provider=:provider AND event=? AND id<>? AND state='pending'").run(part.event, part.id);
 }

package/dist/route-results.js

@@ -14,6 +14,7 @@ import { INELIGIBLE_REASONS, REASON_WORDS, selectionSchema, } from "./contracts/
 import { changedFilesOf, COMPLETION_ACTION } from "./result-completion.js";
 import { runAccounting } from "./store.js";
 import { INFRASTRUCTURE_TERMINALS, saveResultRecord } from "./route-store.js";
+import { wasInterrupted } from "./run-ending.js";
 // The execution class and the cohort snapshot live with their writer (route-store.ts), which store.ts imports: kept
 // light so the store's module graph doesn't reach the evaluator's readers.
 export { cohortOf, EXEC_CLASS_OF_REASON, execClassOf } from "./route-store.js";
@@ -49,7 +50,7 @@ function classOfRun(run, kept) {
         return kept;
     if (run.terminalClass != null && INFRASTRUCTURE_TERMINALS.has(run.terminalClass))
         return "infrastructure";
-    if ((run.outcome === "interrupted" || run.reason === "interrupted") && run.providerStartedAt === null)
+    if (wasInterrupted(run) && run.providerStartedAt === null)
         return "infrastructure";
     return "model";
 }

package/dist/run-ending.d.ts

@@ -0,0 +1,21 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export declare function wasInterrupted(run: {
+    outcome: string | null;
+    reason?: string | null;
+}): boolean;
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export declare function endedInterrupted(run: {
+    outcome: unknown;
+    reason?: unknown;
+}): boolean;

package/dist/run-ending.js

@@ -0,0 +1,19 @@
+/**
+ * How a run ended, asked one way.
+ *
+ * "Interrupted" is stored in two spellings. Every ending written today is the outcome `failed` with the reason
+ * `interrupted`. Rows written between schema 25 and 114 carry the outcome `interrupted` itself (a held session cut
+ * down mid-flight) and still read. A check that knows only one spelling treats the same event two ways, so every check
+ * asks here.
+ */
+export function wasInterrupted(run) {
+    return run.outcome === "interrupted" || (run.outcome === "failed" && run.reason === "interrupted");
+}
+/**
+ * The spelling written today, and only it. The roads that hand an interrupted attempt's draft to the next attempt
+ * (salvage in the checkout, the recovery grant, the check a run never reached) ask this one: they were built for the
+ * runs that write it, and reading the old spelling there would widen what they recover.
+ */
+export function endedInterrupted(run) {
+    return run.outcome === "failed" && run.reason === "interrupted";
+}

package/dist/scope.js

@@ -1443,7 +1443,7 @@ import { permissionPlainWords } from "./chat-terms.js";
 import { limitRecognised } from "./exhaustion.js";
 import { SUBSCRIPTION_CAPABLE } from "./keys.js";
 import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1558,7 +1558,7 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.state === "revoked")
         return refuse(`${a.endedBy ?? "an approver"} stopped carrying commits for this release`);
     // Expiry stops every live state (security review): an operation already reserved finishes only through reconciliation.
-    if (a.state === "expired" || ((a.state === "open" || a.state === "deploying" || a.state === "merge-reserved") && a.expiresAt <= now.toISOString()))
+    if (releaseStateAt(a, now) === "expired")
         return refuse("the release approval expired");
     if (a.state === "merged")
         return refuse("the release was already merged");

package/dist/server/render-results.js

@@ -2,6 +2,7 @@ import { assignmentPresentationOf, historicalAssessmentReason, shortenedMaterial
 import { assignmentActionHref, assignmentStatusOf, assignmentWithEvidence } from "../assignment-ui.js";
 import { assignmentChecksForRun, owedAcceptance } from "../assignment.js";
 import { releaseCoverageOf } from "../release-coverage.js";
+import { wasInterrupted } from "../run-ending.js";
 import {} from "../browser-workspace.js";
 import { CHECK_LEVEL_WORDS, liveQuickCommand } from "../check-levels.js";
 import { LIMITS } from "../decision.js";
@@ -942,7 +943,7 @@ export function runOutcomeBadge(run, live) {
     if (!live && run.role === "planner" && run.reason === "plan-drafted") {
         return html `<span class="badge">Planned</span>`;
     }
-    if (!live && run.reason === "interrupted")
+    if (!live && wasInterrupted(run))
         return html `<span class="badge">Interrupted</span>`;
     return live
         ? html `<span class="badge badge-running">Running</span>`
@@ -2080,7 +2081,7 @@ export function runOutcomeChip(run, live) {
         return chip("Running", "live");
     if (run.role === "planner" && run.reason === "plan-drafted")
         return chip("Planned", "done");
-    if (run.reason === "interrupted")
+    if (wasInterrupted(run))
         return chip("Interrupted");
     const word = sentenceCase(run.outcome ?? "never finished");
     return chip(word, run.outcome === "built" || run.outcome === "no-change" ? "done" : run.outcome === "failed" || run.outcome === "refused" ? "failed" : "");

package/dist/server/render-tasks.js

@@ -3,6 +3,7 @@ import { archivedWords } from "../tidy.js";
 import { btn } from "./kit.js";
 import { whenUtc } from "../when-html.js";
 import { networkWords } from "../egress.js";
+import { wasInterrupted } from "../run-ending.js";
 import { chainTermsLines, liveChainFromJson, releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
 import { SUBSCRIPTION_CAPABLE } from "../keys.js";
 import { RELEASE_CI_RUNNING_WORDS } from "../release-ci-hold.js";
@@ -1862,7 +1863,7 @@ export function taskBodyParts(data) {
     const workerRow = liveRun !== undefined
         ? prop("builder", html `${liveRun.runner} · <a href="/r/${liveRun.id}">build #${liveRun.id}</a> running`)
         : data.runs[0] !== undefined
-            ? prop("last attempt", html `<a href="/r/${data.runs[0].id}">${runNoun(data.runs[0])} #${data.runs[0].id}</a> · ${data.runs[0].role === "planner" && data.runs[0].reason === "plan-drafted" ? "planned" : data.runs[0].reason === "interrupted" ? "interrupted" : data.runs[0].id === liveHistoryRunId ? "running" : data.runs[0].outcome ?? "never finished"} · ${data.runs[0].runner}`)
+            ? prop("last attempt", html `<a href="/r/${data.runs[0].id}">${runNoun(data.runs[0])} #${data.runs[0].id}</a> · ${data.runs[0].role === "planner" && data.runs[0].reason === "plan-drafted" ? "planned" : wasInterrupted(data.runs[0]) ? "interrupted" : data.runs[0].id === liveHistoryRunId ? "running" : data.runs[0].outcome ?? "never finished"} · ${data.runs[0].runner}`)
             : "";
     const queueRow = data.position !== null && data.position !== undefined && task.state === "queued"
         ? prop("queue", html `${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : html ` in ${data.position.column}'s queue`} · <a href="/tasks?view=order">reorder</a>`)
@@ -1885,7 +1886,7 @@ export function taskBodyParts(data) {
         facts.push({ label: "Builder", parts: [`${liveRun.runner} · `, { label: `build #${liveRun.id}`, href: `/r/${liveRun.id}` }, " running"] });
     else if (lastRun !== undefined)
         facts.push({ label: "Last attempt", parts: [{ label: `${runNoun(lastRun)} #${lastRun.id}`, href: `/r/${lastRun.id}` },
-                ` · ${lastRun.role === "planner" && lastRun.reason === "plan-drafted" ? "planned" : lastRun.reason === "interrupted" ? "interrupted" : lastRun.id === liveHistoryRunId ? "running" : lastRun.outcome ?? "never finished"} · ${lastRun.runner}`] });
+                ` · ${lastRun.role === "planner" && lastRun.reason === "plan-drafted" ? "planned" : wasInterrupted(lastRun) ? "interrupted" : lastRun.id === liveHistoryRunId ? "running" : lastRun.outcome ?? "never finished"} · ${lastRun.runner}`] });
     if (data.position !== null && data.position !== undefined && task.state === "queued") {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/tasks?view=order" }] });
     }

package/dist/setup-guide.d.ts

@@ -15,12 +15,12 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
     fingerprint?: never;
     installed?: never;
+    content?: never;
 } | {
     message?: never;
     ok: true;
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
     fingerprint?: never;
     installed?: never;
+    content?: never;
 } | import("./skills.js").InstallResult;

package/dist/slack-chat.js

@@ -11,7 +11,7 @@ import { processChatEvent, planChatNotifications, channelAccess, planRoomMessage
 import { proposalPreview, proposalLink, proposalOutcomeText, armedCardText, armedYesLabel, } from "./chat-channel.js";
 import { LEAD_MESSAGE_MAX_CHARS } from "./lead.js";
 import { renderReply } from "./reply-shape.js";
-import { ChatDeliveryError, ChatState, chatHash, partContent } from "./chat-delivery-state.js";
+import { ChatDeliveryError, ChatState, chatHash, chatRetryAt, partContent } from "./chat-delivery-state.js";
 import { readChatPart } from "./contracts/chat-content.js";
 import { readSlackBlockActions, readSlackButton, SLACK_LINK_ACTION } from "./contracts/slack-callback.js";
 import { object, slackId, slackTs, slackMember, SlackError, uploadSlackBytes, } from "./slack-api.js";
@@ -444,8 +444,7 @@ export async function deliverSlackPart(options) {
             ? error
             : new SlackError("Slack delivery is waiting to retry", 15_000, true);
         state.setProblem(identity.installation, options.owner, problem.message);
-        const until = new Date(nowOf(options).getTime() +
-            Math.max(problem.retryMs, [5000, 15000, 60000, 300000][Math.min(row.attempts, 3)])).toISOString();
+        const until = chatRetryAt(nowOf(options), problem.retryMs, row.attempts);
         state.partFailed(row.id, { problem: problem.message, until, uncertain: problem.uncertain });
         if (problem.code === "ratelimited")
             state.deferUntil(identity.installation, until);

package/dist/staged-runtimes.js

@@ -12,6 +12,7 @@ import { lstatSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSyn
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { basename, dirname, join, resolve, sep } from "node:path";
+import { isDeployed } from "./deploy-phase.js";
 import { quarantine, quarantineEntries, claimQuarantine, releaseQuarantine, restoreQuarantine, deleteQuarantineSync } from "./sweep-quarantine.js";
 import { processCensus } from "./run-closeout.js";
 const DAY_MS = 86_400_000;
@@ -84,7 +85,7 @@ function readStage(path, name, fallbackAt) {
             at = 0;
         }
     }
-    const finished = deploy !== null ? deploy["phase"] === "deployed" : update !== null ? typeof update["finishedAt"] === "string" : false;
+    const finished = deploy !== null ? isDeployed(deploy["phase"]) : update !== null ? typeof update["finishedAt"] === "string" : false;
     const from = update?.["from"];
     const prior = typeof deploy?.["priorRuntime"] === "string" ? deploy["priorRuntime"] : typeof from?.dist === "string" ? from.dist : null;
     let keptAside = false;